32f2039d0e5bc108f00a491d16a6b3a1dd88f0020124a5f268678766f300427c

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_30093087599bb26f3451f2cf795c5223_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 26.1MB
Sample261110-3ebccsst8n
SHA256 32f2039d0e5bc108f00a491d16a6b3a1dd88f0020124a5f268678766f300427c
MD5 30093087599bb26f3451f2cf795c5223
SHA1 0b5344fb4076ae625e53b91840ef2ea6b25b5de0
SHA512 03d70e32d098ae4d4856d44ae2a726d9af86a55b9d1ca9421164543fad637993009baee7c1f5b47956de78e44343b83baaaf0818b317366a0eff239095138bc1
SSDEEP 393216:3t7hQ+gkMvtMg17hQ+gQ7hQ+gQ7hQ+g47hQ+g57hQ+gw7hQ+gP:35hrMvJBhfhthVhKhthO
TLSH
T151572345B7D9A166E07B0A34D87A611197B0FC418B61C79F26E07B2D2C317D0AE363EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence ransomware rat

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3352	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (f80a49e1ea431227)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (f80a49e1ea431227)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&s=6b44db61-091b-45af-beea-c9d5bdcdd3bb&k=BgIAAACkAABSU0ExAAgAAAEAAQBPy706OdOCaehfocFNeq1NEFuKHHRHzMSY5zv6D0PZnyjX9CcXuOW6dU0SgRio8hTqN12U%2fv3xsxesb3IYvjV9oU8MsdjK1%2btBA%2bx3r4DOtZKITrBk4cwqvVob0%2fPoe4Ial%2f3V4xAWR14BeNO85STAUi8GdxESIUW4Sesqgb8Wit5NfjNbsFBLryOkj3G9gpWfX7D4Gx5ORCOKroHXcoIILlsk4vGmaJbIxek9W8W0h8J5NH0uZyrUu1J4hoL7tXA4EhxMIKcgeElE5uiQVcqXW5PMfdBz0VmVNcqWb0nM5ozCsSsu1xT%2bnfg9KnEjH5l8t354Z6ty8%2f%2foI%2bPVb%2fKt&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA%2bBJjC92wnE%2bs5StMxOxXDQAAAAACAAAAAAAQZgAAAAEAACAAAACNwmiz8L2Alw7IvwR2QksoRjmEKwhUdE1DzULUMzd2NQAAAAAOgAAAAAIAACAAAADzVzDYIB7KEJufVqzXKFP3sYitOjwNUE2P6PzSmUTa6KAEAADnCY4MCxDbJYLRsyHXmBzDceiHRKY2TtQmTQWz2iO6bQHeB1vxfiUEPNCu130FpP2PY56uAaxRGz2Cxj2Nk%2bJl6TqNQeOHsew1mtpbR5iOXfykOGf33Wx%2b79rcNT5QKmpmBo%2bKJt99iP3dNoPUpaQd2MTyuNPhpsykAQ6XlpnK5PfOzrlWecEwwJcAW%2fYJsAYAHSQztpNn%2baFWdbSUUCCxd4LRFkY3jYKiQ4ae4u9Urdgx0HqrSbVtJxR%2bf5vxsGhCXWmQJjtXeJulWJwkxpB20ozfGE%2fCyOIonmUDagolj%2bm5DrSDSPXWKsDMloztoVDDfsLJk9ZFRssMsTlwMf%2bCayjeiZdDI8rheH%2bcuDklHtUthLAjtjLkiKJsfPvLIFOsGwDSDiSvMUfqzdy28l1fYb%2fA8U%2fr%2b2zyEjPaZ%2fbI5z%2fu8%2bKXgU1Oz8ZGQzxutAnNIGqWIQ3m2m0eNVcQlfD9zZllzoaeZcJc4pSaWHlwKxpIzxHz4gJmnmvYTo%2bflW9WbkQUpRYvaXpair17CUxQLEH0iFN6K2u4WodTo22DUWCVBRhT1aK%2foFCx8936U6TGZ0Nbdwqkiy2PWTNfBGGeFBL3sFQLiq8flaGbxS66phbD3YCrVZNIZvjOdulcHkniMFqSwVLVWmDjpfdk85elrbpBeQHP81%2fUNS6VMS9rNEnHBPA%2fv0q6JYpLvH4nTMIkguWVwRl%2bhc5cFXAqGurNBnknjlqZ4T%2byuQrY9MyUb0Qs0CaAlBkjRuRVuZqwmtGk7ssrpDrKGyACa5Zp4autGPfl%2fo4xVcvHmFxFLd0rz%2b2CXOTLFB6DoeS6TgBSF9Gg%2bNuvUUuYYek9gQ5uYF6JdfsnEd4Mu2U0S%2br8j8EfgnmM6DsN6KJ3QxijQOAb%2ftEy2tscxd50SfaPGGdveHOxQNf4mIaRWkG5LVogvwHC%2bf6hAsS0Y7YcFZIr0Gsq%2fHY8pdxtxZMq0iWMEDUMww%2fwhXheCJHfwJyGANij5rm2ojn%2fSY7Bgj0hHAnPZAUB%2bfj79YIvZ77ZAqPnYzcwWvEKt2xEv5l5gpOVsvrESduk6V43tfzSd7dfq2tAOSVS1SJ9SYO45fmaahj%2btZaTiUsEINbH%2b9Dk1FRZ8XTnDb4Ma0iDADkSi0Pk5HkxAhARpi7ujtJw6QIEmSf2Xc%2fudKoMLjRWsXXGKkwysY1B%2flnTJ36oDLSl0EtZt1Ty9E7omZz3VsjXmQaeUvuOnDjqhK9hMTOnx8zXKHTCapKno4H%2b0pF7TPQbHBreZDGhpFeQJ73CDNrNz3PR4v4BRyaWLhIBL9Ag3EH5AXCuBDCSA3auXb25%2bee8oNFOrcJUnTALwilcZScGVOI4OYrU6QCpTnI59fL2GcBskpoGzYWc5LinwcgZ%2b%2fgfPIm8Q3HsDKcaIV0%2f34zZTJkIY7OWLtElvCf%2fLZALuu84Z34Nya6NObn%2bgkQxHLDjrhJHMPcf5Kpb8YQCwTkQPQaJOmSeEOB9nJ1N4J%2f%2fgqaoBTJ%2fRGLIt4p%2frzgxQC23x5FYDZdvDD2HWVnC2DraGCSdJ03WMQlFz7ewmtxPBIMf89FPqydrsv7ZGEAAAAA86XaijSjOwMX2JQTcP1Yl2GQjNBl8Dgi2VjOxsvxsQ77HLGjeeuSsAy%2fOf40dqw%2fwYUndB30Nbk3zMXtUQ5NI\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Executes dropped EXE 2 IoCs

pid	Process
4360	ScreenConnect.ClientService.exe
4560	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
3204	MsiExec.exe
1128	rundll32.exe
1128	rundll32.exe
1128	rundll32.exe
1128	rundll32.exe
1128	rundll32.exe
1128	rundll32.exe
1128	rundll32.exe
1128	rundll32.exe
1128	rundll32.exe
3204	MsiExec.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3204	MsiExec.exe
5872	rundll32.exe
5872	rundll32.exe
5872	rundll32.exe
5872	rundll32.exe
5872	rundll32.exe
5872	rundll32.exe
5872	rundll32.exe
5872	rundll32.exe
5872	rundll32.exe
5396	MsiExec.exe
2732	MsiExec.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\mdqltod1.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\oglgujkx.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\avwdkvxt.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\y0lfqz1x.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\ie4ixvb5.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\bzv1hlzg.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\hq1uetcn.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\dzfep3n4.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\mdqltod1.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\11qtevrh.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\npjfvple.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\y0lfqz1x.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\oglgujkx.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\bzv1hlzg.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\avwdkvxt.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\npjfvple.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\dzfep3n4.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\11qtevrh.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\hq1uetcn.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\mdqltod1.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\dzfep3n4.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\bpgu3fez.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\npjfvple.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\ie4ixvb5.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\bpgu3fez.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\y0lfqz1x.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\bzv1hlzg.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\bpgu3fez.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\11qtevrh.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\hq1uetcn.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\ie4ixvb5.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\oglgujkx.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\Client.Override.resources	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD7B7F332E4EE5C14.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI165A.tmp	msiexec.exe
File created	C:\Windows\Installer\{5AD45F14-16D1-4476-8B29-4C1B6E363BA9}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{5AD45F14-16D1-4476-8B29-4C1B6E363BA9}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9B2211C6978E5805.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC6998C87DBA739C7.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{5AD45F14-16D1-4476-8B29-4C1B6E363BA9}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e5a0cf2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12EE.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a0cf4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0cf2.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5AD45F14-16D1-4476-8B29-4C1B6E363BA9}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF27D1ADD47A45730.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_30093087599bb26f3451f2cf795c5223_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.7.6.9783\\f80a49e1ea431227\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-f80a49e1ea431227\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\97C726BAA3C25EE98FA0941EAE342172	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f80a49e1ea431227\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\ProductName = "ScreenConnect Client (f80a49e1ea431227)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\PackageCode = "41F54DA51D616744B892C4B1E663B39A"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f80a49e1ea431227\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\Version = "436666374"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\97C726BAA3C25EE98FA0941EAE342172\41F54DA51D616744B892C4B1E663B39A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.7.6.9783\\f80a49e1ea431227\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f80a49e1ea431227\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-f80a49e1ea431227	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f80a49e1ea431227	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\41F54DA51D616744B892C4B1E663B39A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f80a49e1ea431227\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f80a49e1ea431227\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f80a49e1ea431227\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (f80a49e1ea431227)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\41F54DA51D616744B892C4B1E663B39A\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41F54DA51D616744B892C4B1E663B39A\ProductIcon = "C:\\Windows\\Installer\\{5AD45F14-16D1-4476-8B29-4C1B6E363BA9}\\DefaultIcon"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4772	msiexec.exe
4772	msiexec.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	2026-11-09_30093087599bb26f3451f2cf795c5223_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	720	msiexec.exe
Token: SeSecurityPrivilege	4772	msiexec.exe
Token: SeCreateTokenPrivilege	720	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	720	msiexec.exe
Token: SeLockMemoryPrivilege	720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	720	msiexec.exe
Token: SeMachineAccountPrivilege	720	msiexec.exe
Token: SeTcbPrivilege	720	msiexec.exe
Token: SeSecurityPrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeLoadDriverPrivilege	720	msiexec.exe
Token: SeSystemProfilePrivilege	720	msiexec.exe
Token: SeSystemtimePrivilege	720	msiexec.exe
Token: SeProfSingleProcessPrivilege	720	msiexec.exe
Token: SeIncBasePriorityPrivilege	720	msiexec.exe
Token: SeCreatePagefilePrivilege	720	msiexec.exe
Token: SeCreatePermanentPrivilege	720	msiexec.exe
Token: SeBackupPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeShutdownPrivilege	720	msiexec.exe
Token: SeDebugPrivilege	720	msiexec.exe
Token: SeAuditPrivilege	720	msiexec.exe
Token: SeSystemEnvironmentPrivilege	720	msiexec.exe
Token: SeChangeNotifyPrivilege	720	msiexec.exe
Token: SeRemoteShutdownPrivilege	720	msiexec.exe
Token: SeUndockPrivilege	720	msiexec.exe
Token: SeSyncAgentPrivilege	720	msiexec.exe
Token: SeEnableDelegationPrivilege	720	msiexec.exe
Token: SeManageVolumePrivilege	720	msiexec.exe
Token: SeImpersonatePrivilege	720	msiexec.exe
Token: SeCreateGlobalPrivilege	720	msiexec.exe
Token: SeCreateTokenPrivilege	720	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	720	msiexec.exe
Token: SeLockMemoryPrivilege	720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	720	msiexec.exe
Token: SeMachineAccountPrivilege	720	msiexec.exe
Token: SeTcbPrivilege	720	msiexec.exe
Token: SeSecurityPrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeLoadDriverPrivilege	720	msiexec.exe
Token: SeSystemProfilePrivilege	720	msiexec.exe
Token: SeSystemtimePrivilege	720	msiexec.exe
Token: SeProfSingleProcessPrivilege	720	msiexec.exe
Token: SeIncBasePriorityPrivilege	720	msiexec.exe
Token: SeCreatePagefilePrivilege	720	msiexec.exe
Token: SeCreatePermanentPrivilege	720	msiexec.exe
Token: SeBackupPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeShutdownPrivilege	720	msiexec.exe
Token: SeDebugPrivilege	720	msiexec.exe
Token: SeAuditPrivilege	720	msiexec.exe
Token: SeSystemEnvironmentPrivilege	720	msiexec.exe
Token: SeChangeNotifyPrivilege	720	msiexec.exe
Token: SeRemoteShutdownPrivilege	720	msiexec.exe
Token: SeUndockPrivilege	720	msiexec.exe
Token: SeSyncAgentPrivilege	720	msiexec.exe
Token: SeEnableDelegationPrivilege	720	msiexec.exe
Token: SeManageVolumePrivilege	720	msiexec.exe
Token: SeImpersonatePrivilege	720	msiexec.exe
Token: SeCreateGlobalPrivilege	720	msiexec.exe
Token: SeCreateTokenPrivilege	720	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	720	msiexec.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
720	msiexec.exe
720	msiexec.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe
4560	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
720	msiexec.exe
4772	msiexec.exe
3204	MsiExec.exe
5396	MsiExec.exe
2732	MsiExec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 720	3100	2026-11-09_30093087599bb26f3451f2cf795c5223_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	90
PID 4772 wrote to memory of 3204	4772	msiexec.exe	92
PID 3204 wrote to memory of 1128	3204	MsiExec.exe	93
PID 3204 wrote to memory of 3352	3204	MsiExec.exe	94
PID 3204 wrote to memory of 5872	3204	MsiExec.exe	95
PID 4772 wrote to memory of 5940	4772	msiexec.exe	100
PID 4772 wrote to memory of 5396	4772	msiexec.exe	102
PID 4772 wrote to memory of 2732	4772	msiexec.exe	103
PID 4360 wrote to memory of 4560	4360	ScreenConnect.ClientService.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-09_30093087599bb26f3451f2cf795c5223_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_30093087599bb26f3451f2cf795c5223_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.7.6.9783\f80a49e1ea431227\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-11-09_30093087599bb26f3451f2cf795c5223_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:720

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4375211DBED7C09B3602BC76D6E8A5BB C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC058.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240763109 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1128
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC5A9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240764390 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3352
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSICBA5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240765968 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5872
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 844AB18F46DD72D043E39DD5443EC857
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5396
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FD27ECCA18F2C524146976531C08CE4D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:688

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1304

C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&s=6b44db61-091b-45af-beea-c9d5bdcdd3bb&k=BgIAAACkAABSU0ExAAgAAAEAAQBPy706OdOCaehfocFNeq1NEFuKHHRHzMSY5zv6D0PZnyjX9CcXuOW6dU0SgRio8hTqN12U%2fv3xsxesb3IYvjV9oU8MsdjK1%2btBA%2bx3r4DOtZKITrBk4cwqvVob0%2fPoe4Ial%2f3V4xAWR14BeNO85STAUi8GdxESIUW4Sesqgb8Wit5NfjNbsFBLryOkj3G9gpWfX7D4Gx5ORCOKroHXcoIILlsk4vGmaJbIxek9W8W0h8J5NH0uZyrUu1J4hoL7tXA4EhxMIKcgeElE5uiQVcqXW5PMfdBz0VmVNcqWb0nM5ozCsSsu1xT%2bnfg9KnEjH5l8t354Z6ty8%2f%2foI%2bPVb%2fKt"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.WindowsClient.exe" "RunRole" "fd0c6686-a138-489d-ab7a-8ee48c802adc" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a0cf3.rbs

Path C:\Config.Msi\e5a0cf3.rbs
Size 213KB
SHA256 7da147f3dd3f20ddfb72770b34b8fbcb2a483169c22d727e5e59b33feddb5112
MD5 2b7dd22e6142e2e62b36e123713b75e0
SHA1 84c995908c2de89a3057e6bffe1d17b79f118613
SHA512 7391f4ab87b03468bd39c235e69b8adc07b07984bdaebd9b6d96c01d5aa7452f44a65289aecb60d9c6ff5d21a77116591693562bb45b03b19fc8576df6152858
SSDEEP 3072:Jr9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGI:JruH2aCGw1ST1wQLdqvI
TLSH
T12B248C226494907EE7FA1A32D93F9A717E3CF6281760C59EC3848C1E5D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\Client.Override.en-US.resources
Size 512B
SHA256 79ab11642060dd828322763efe11fb86ca52cd3f30d5dd5601b83b2d202ef69f
MD5 d0f54c849d9a6abcefc49f922eaa37bc
SHA1 9b9c842a64c9bb46082da60883470e92b0c7e8bd
SHA512 3bf0b8754b0591297a4d221acfe8d63c3a6a0988b7a338f5875f5c4d6d251efa09be24748164b8c907b57237a7940bb18b4d4abe556695b07f34cfe080fee544
TLSH
T13EF02016235C2235D4A3077F34D634C1297BF55D9230446C7854301C57B39064E82723
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\Client.Override.resources
Size 14KB
SHA256 dde983f20328c6087f279b441502d34a734bc51547e22643cf79c484bd8c2363
MD5 cbc6582790989f66a47f43ec22f7f89c
SHA1 b781a628c504914706e02b951b8626a5dbd7b28b
SHA512 18dc2fec8beb0392d42ace2461d5c163fe9bfe2f2528a519944d6b38d9068b1974d259966c62ef32d08548677de7d6ad49413693a4a2668b1e1bdaad348d1f5d
SSDEEP 384:rWZYy2cb7/IK9ZqsHuPX3+tIZlAzsaKLvmYh+klpNCWWCmmYyDvH:6r7/IgqsOPX3+GnZDmYc2pWRG
TLSH
T19062C09F76D5AF74C22A493B70C710A27C7F8DCCA5148A4B5A11A412AB38DCDC2E4B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\Client.en-US.resources
Size 65KB
SHA256 bd8901dd3666277f6d7aa1f4118ad53f5d4229c5d9f67f94e635bf2add3731dd
MD5 7596549052e6f60e5a50b72fbabbbc52
SHA1 b79c87fba66c4256b2bd8dbfa4e28f7e164b127a
SHA512 33d628e724a74a903c83fc830fa60e70bf2ddd89de8071184a5079cd601a354bbf2f50756ee7348bbbfcaed2f10fe0d1fd21ab547147fc13f142b4b27ba2b714
SSDEEP 1536:391nDzSbBYQdQ5Fe2rmcPpZfjZ8peFTp9EwILThIKC1QzpbLeMarw:391DzSbaQCe2rmcPpZfjZ8peFTp9EwII
TLSH
T10C531D1277FD0A18F5F36F75BE7A94619937BC5A2E25C06E1028854E0972F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.Client.dll
Size 628KB
SHA256 8ed29767837e883bc9577cc4fb3705d60dedd7fe8d28515aa26646e0302bed24
MD5 4a35c09d240c685b085ce550f68d9252
SHA1 1b85f45bae4dda9836376963a901aacc4049feaf
SHA512 0ae85ae7e71038a39ce6400ddab38bb39e8f8d3ae1546c56ce4d1dd27c47919a01529f81d4539ff917e3565a81feb3bee706bd1ebb8e8f1e837373207c774650
SSDEEP 12288:6cZ7YfSLFwTE5Hzhmj5KazHTEavSW7OQniu3bsAuaq:6cWCwA5hERzEn8qu3bPuaq
TLSH
T1B0D4C04DE794AD29ED6E0B73B59127209AB0ACCA945BE30F1DA4737D4D723847E4C2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.ClientService.dll
Size 192KB
SHA256 2ccff7ba32fb18af838459307fd2bb9ed1e4cd1805cf0675eccdaad31827e1e9
MD5 616dbe982fa7cfcdf79b8bba3187833b
SHA1 3a30149340d6a9f94c8027916a8634c329ffbf94
SHA512 b4b26a064a8333afd9ad6da3ac3f361c307ca5c93f072672d53206974a92b4df1ac0f39d23c65b3fdac29c829ef951580806d293642a32c08b0eb4df88cdc0eb
SSDEEP 3072:lyuiZD7L1WbX2Ma+rYmh53mP8vQIMAw8yNgaYxlfQiVwKXorZc:uvL62sbe8PFyOxFO1u
TLSH
T1FB14AF48BB5AD416C99F0E3BE861B26002F1A443DDE7D78F6C8862DE1E563C51F543CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 fa88997b02d98d2d2829b8d9f4aca92ef4ae55f0c21ed82db81ee86c423c9d46
MD5 8667c39f52f3fef8cc452e002c4a856b
SHA1 cecc186b75dc811800dc376a0eba6fe7c232ccdd
SHA512 11ce57245b224b53475c1c0b6b1763181c690dff1a0f8cedb4b9268f2a6b14207294fe08b6c335362cb25620ffe4ee99c1aebbfa1b1c37feec14c19e41fd062b
SSDEEP 1536:Mg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkU0HMP7RekZg:1hbNDxZGXfdHrX7rAc6myJkgkU0Ha1e
TLSH
T12E935B13B5C28871D573093158E0DAB09A7FF9215E61DEAB3788022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.Core.dll
Size 1.3MB
SHA256 8e868637ac960e1c7c98cba86ee157a25a37aa560434ff2f1e4abdf81774d5d6
MD5 9bc65903fe3e5b080a89197e231827d9
SHA1 33c304d9dc24741e9c888725bf5f6f70b0f782bc
SHA512 b33123e4f772802ad2aab6d153b926586b5952239ac3cc066cd56e928c080395163154eb266ddcc04072b789851ff9c410140437b70655d378e3bb4cc6b9a06d
SSDEEP 24576:zBYjbswXly3xJCFuC5onhQ6tN7f3vtNk1KW2eQ2JL:unxXHul7f31zTeQ2JL
TLSH
T179558D8E7B89E627DA7D0A3784602214A7B0E0D25F67D70B69E0FB7D0C953A87E451CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 91b1c12ab90387e29e1bc357cbf9c0edc829872e9a964d2538ea2f5ac1eece3f
MD5 3f4816cfcb143113bac5d7564f664fd4
SHA1 7a7fe42dfea511ab33cebb757acac38359628427
SHA512 7af0408163c1a4d73a6a9219825da1cf30b3ee97af10bc9af2142aaf8f39742a2ad0ea7adb1caf0ec20783dcb14b846de9e7259d4cc3f83346f00e39871f55b0
SSDEEP 24576:qZbsJXFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsO:PXJkGYYZTk+T1iH7efPjre
TLSH
T1E295AD41E6C368FAD46B053888BE632AB7747C040355CBFB97D4AA392D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 dbf62f4d0d159245a18a55627ee1477214188e4973b4af9be3cd4977293bc845
MD5 3e998dcaa9f9531933fed9ddd51e57c0
SHA1 799cd91f67f0458ec9838ea08ca8be33f6ccd3be
SHA512 6d9a4dca64c98e8b71b88112f835265c56e79c444c93688a488f97bfb707857f87e51c0dd7b6c7e913c8c2566f05799f7e9c6034ba16b3722efb430596bd4623
SSDEEP 24576:hlzNWqSl6HT38IIT9zCrReOAu4vbBkZxcKAPH4PDA:hRNWqi6IIIBzCFMNBNz
TLSH
T14F759E89BE99EE3BC86F077780602114A7F08891CF63DB575894B77E1DC93C46D48A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\app.config
Size 711B
SHA256 1e8d64cf40bd891db2c8634348a8fa9649a6fb3c7f8001077db02c6df714ea33
MD5 1c2453a3c93a32427f58a82d489a5043
SHA1 b310a7f3ec3ffe4633162ff69e2d06bfcdf2496d
SHA512 9108bdbd4db7513e4e8c85380c9698f369285f14f22f6b5bebf9b37917f66061614e2fa0af9fcd7a96476bb937246f8f405b2de46db543ac6d10fe61536066c6
TLSH
T1F1018459B5D0AE5A02B35A33E6314681EC7056630165A0E478EF31375F30ACE07F33E9
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (f80a49e1ea431227)\system.config
Size 908B
SHA256 bb684d7443f504f16e0045259b573f0af2986411e8061bad1917a532c7ef322f
MD5 fd305bd811575611d32700509fe1f2a6
SHA1 e045664285142b6c85e75ddc1c5b12362ffdf93a
SHA512 221df05c203481bdbef0d6608f61e6eb5191f4453d78754ae5ec02ba1bb5258ec19eaf892699a419a5f7773bcd8a5b7ee404da87511059e0b6889dc9a357e30c
TLSH
T1631123553344795703A30A23C5214344AEB62F4B156654C8357E623FAF319CA0B536EE
MD5 SHA1 SHA512 TLSH

Submit Download

MSIC058.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIC058.tmp
Size 1.8MB
SHA256 9dd7b036d6c96671493f386e361d4dda85baf06318d33162b661b7774ddcbb5a
MD5 9e24aa8f8e08c0b156bc8c57e3e0b789
SHA1 778070982927e5cbc1eea75e1425efc7f1bc2600
SHA512 df667e683e44a878ebd9bf289bb4e9d8d447aa145fe1e68d609de789ba88cfd2b2691f88bc023666b183c4c2b324252a960ddb65eac15e441dfa2f639eab17c4
SSDEEP 49152:eGxY0IVpJpyLAryaXSCKLQmt8ecX2xMIBJOaf987ICbHDAgLjp:eGCTCAr8CK/tsX2xMIBkaf90dj9jp
TLSH
T12E95336536F48030FAFA66341CA9F17216FA79604770438D6A846B3C9EA1BD5DF343A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIC058.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIC058.tmp-\ScreenConnect.Core.dll
Size 1.3MB
SHA256 ebad16c37e69db26ce35326c2cad62754545c77079aa09e6725c41201d15ceac
MD5 045517d5dab9f2ffdfe80a6e0310f255
SHA1 a3a39def46e5586b221bb64adef948203bec2e3c
SHA512 74eedb95e04add0860bcc1a60b1b0fd583a60fa908134219fd3016f3ea57689ae07bbb8a7342d27d4b146e928be9fd2474c75cfc5fc9ae05d91a4c28c44f5c10
SSDEEP 24576:XBYjbswXly3xJCFuC5onhQ6tN7f3vtNk1KW2eQ2J:SnxXHul7f31zTeQ2J
TLSH
T1AC558D4E7B89E627DA7D0A3784602214A7B0E0D25F67DB0B69E0FB7D0C953A87E451CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIC058.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 f35f007dcb154d0346745309630b8cc21fe49638e76dc8dd77a3c62cb0aa754a
MD5 2b5e159d82a691b088ad142a25ab6510
SHA1 19cdc5300313af100e400f947e15365c5de115cf
SHA512 0526b74ec317b7bdae9214461cce97432ea99c74aab5e1af90c958c7a483a28b2f290f81a4bdb8aac104d206365e72a3da1395db728e2114190231b438386c8f
SSDEEP 384:LbazzV1VTsaS8hQlLkmoA8V7NaNeirM0dbMsFkjvZBL206Q5e:PazC98VMcLv52
TLSH
T141B2C630674DE27AF9EA1634B563FBA001B3BDB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIC058.tmp-\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 ba4443859d9acb27d20522969b082ca05cf87add0750192337ba064383bd1220
MD5 7e0aeed6f5bf937dd801d2621a374e61
SHA1 48163e69c70761541d3e410ee81e5bea12112345
SHA512 0353277b129bce7883cb0d98708b8c70f9ff85c6871aa7b055d9a33d56ba0854fb3c21f3d4801c78e79a7c2d37f32fba82e904b9eea97bc3c1b8860f0d2ea89f
SSDEEP 24576:DZbsJXFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsX:qXJkGYYZTk+T1iH7efPjr
TLSH
T1D095AD41F6C368FAD46B053888AE632AB7747C040355CBFB97D4AA392D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSIC5A9.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIC5A9.tmp-\ScreenConnect.WindowsInstaller.dll
Size 414KB
SHA256 899f4cd45a529c777735b07701ebb1ee09468d5a1ed2a153f3647750fbb22ef0
MD5 180f29a22c3fe26fce8423e66098fab3
SHA1 965ae5c7792100806904e91d212abcb1d7021d9d
SHA512 cabf31064f08cb29dc28047694e7961f53280d99bc16350fe224779e217611ab75eba3359c14feab88c2182b331cf1bd53815f50d37ce69df8fff3db8cc032fe
SSDEEP 12288:7DrRmZoNUQrxC2bR4NIoRnQgJNcprTC1DCG4+m9HB0eLi:7vRUoN7xCMR4NIKnQgJN4rTC1DCG43s9
TLSH
T1BF949D1DBF5AB756E52E4B3BC4123110D2F0D19FAA97C38F5C8426AE6D047E86B981C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.7.6.9783\f80a49e1ea431227\ScreenConnect.ClientSetup.msi
Size 22.4MB
SHA256 9b232b5d23879051efc2445e79f8f881e8c60101d1c0ab8d90eb8b70f4ae7ff1
MD5 39b0ed9760428c7113c641084948c0d5
SHA1 95e10166820952e5133fced17e73373b5012df96
SHA512 f650c0d917808822e1b2b8ae0a69f16f00ffcac546d2724188cd2aab251b961d6de64d486033edaec06c6bcfcbbef4accc1b1696e55d70be62eb638ec75e1146
SSDEEP 393216:d7hQ+gkMvtMg17hQ+gQ7hQ+gQ7hQ+g47hQ+g57hQ+gw7hQ+g:phrMvJBhfhthVhKhth
TLSH
T1CF37337557F8A414F1F32B38EC7A98A24A75BD45CAA0C04F6660390D2834E90DEB77B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI12EE.tmp

Path C:\Windows\Installer\MSI12EE.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11qtevrh.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\11qtevrh.newcfg
Size 839B
SHA256 cfa12c3dbf578c677909b0f72ad37bc2d82a0a916653787853d3a51f9837ca45
MD5 b7e76d785bd12f1ed01da1f89bbcaf75
SHA1 58f81b08e718fa9e7e8e9fecb6d9ff64abb3032d
SHA512 5368fb7fa19829fb36ad048e17f15236ce92f397b1ea793652b0a1a41b3044a33b3c81d2ff61f20abadcc5b82d0b3f02c08a49552d7961103ac19f47f1aaf5ff
TLSH
T1FB01285871C4AE8A12736E32D63147C5FE715B57026A60D874EE22775F308DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

bpgu3fez.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\bpgu3fez.newcfg
Size 839B
SHA256 54679452c557fc95bfcc5bc4d170250711744690b818bf20ed7b8e9b710cf78a
MD5 386bd0425dd1aa3959626cdfe401e46c
SHA1 e313d89a09eaa8ddf01ebcb906ffb4d5ae84872a
SHA512 b7076d82d7dec563999628e3d8454b1d8cb82d2bc384a1cfbcf10383c9ddee23cafd04226c3aa8bdf46d52305ceb9b4b4bc0afee13737cac38dc113a9c59b948
TLSH
T1A801285871C4AE8A12736A32D63147C5FE715757026A60D874EE22775F308DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

bzv1hlzg.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\bzv1hlzg.newcfg
Size 839B
SHA256 e069a41f5febe7df8695e5bdba76e36b51f1c91a23df1016d2edde6b4cb73c7c
MD5 99836a4439843046650198bcd93f7a8d
SHA1 eaca10211f4f9c1a5921ae57ee8c5a87ed4b9573
SHA512 19c7e08f56e8cd361fb63855cbad5f8488eec42c515245da654ac0d31e5820bda6bf70849b99a39324add58a895f19ee0b9c539f42d535b4b857354ae2ceab6e
TLSH
T11701685871C4AE8A02736A32D63243C0FE715757022A60D874EE22375F308DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

dzfep3n4.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\dzfep3n4.newcfg
Size 839B
SHA256 d6ed329de8d1724e5f81691411df74a3617a1262484af5bb2f9333c4c83f2fd2
MD5 0d2cb7717c5e5e08edc6fbee71c95509
SHA1 1572dbf6f419fb9aa6332ead51792f85f9c41e1e
SHA512 781a8abef8ac4c20bcbc241fdbcf51579f7d9318aa8da8380d33b237f6c1469705174a8154686ae30767529b89e100ce27a925f9076e45903db37c5c44a51817
TLSH
T10001285871C4AE8A12736A32D63147C5FE71575B026A60D874EE22775F308DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

hq1uetcn.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\hq1uetcn.newcfg
Size 839B
SHA256 9300ce0a140d396c162cf0f4d6aa71d33e685c9b0746cc860e938d15551b385d
MD5 97e6b2bb1ee0b2e185c531255c7d1b8c
SHA1 fadb9f4cd75ce5a2aac843627057a94f47339c11
SHA512 d8ccd5d8c75b374068cd7c9af885982acb20eb60bd99dbdd3129afd2dc6c39fe6bfdd83ffaf9fb0748f1dd78adfe89a3bad22a8ec7e003df4d11e2dba9412920
TLSH
T1D501285871C4AE8A12B36A33D63147C5FE715757026A60E874EE22775F308DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

ie4ixvb5.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\ie4ixvb5.newcfg
Size 839B
SHA256 be0a6699a0133cbaad25ab0b9ef2d0b8a5e7dc7129fd3c6e10a0bc4a732b01a0
MD5 6af03702c8657a58ab32f67bf757c42a
SHA1 54188d547feec149ef16a9b99609ae9dc6004623
SHA512 8c999f1450d536924c4e60d6640802ddd9d737c3db5859a146bfcc0e382833ee202191a9640930a30fcf57746a09a5e9ff0e95480305e8f9378cdbc822a41453
TLSH
T1BF01685871C0AE8A02B36E32D63143C4FE715B57022A60D874EE22375F308DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

mdqltod1.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\mdqltod1.newcfg
Size 839B
SHA256 f7e63c2bce6d5bc164b7264ef426ebf6ce9bc931a1acd6636251e661eadf9c39
MD5 a0e8906bd0a32531d5c361c201798760
SHA1 d4f3ef24cc892801888a5e4dd7ac6874d92cc953
SHA512 16413fbd55d087b1a0411c3f601adc87427209a16c0f056cb6caaf66b8a1e6807c68e9d8bb95c2cd20b57839e030850972c89350f03953f4cda5cac4122be9e8
TLSH
T14801285871C4AE8A12736A32D63147C5FE715757026A60D874EE22775F308DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

npjfvple.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\npjfvple.newcfg
Size 638B
SHA256 16b9ee449e9b381aeadc6d4d38aa1015f66c7093b00f43528971691808db8702
MD5 2af0f057d1d1d6f0b4bb354eacdb1e01
SHA1 d744e0b7400f47340af7252be6ff9f0ffc9d1f73
SHA512 31c5f0b8039c45679de7289158ec17486289913d16001a524d044ae2871e97f4a4640290b8026bcf940e92401fb13eb0e7190cbbf7ee5daa2af79b228b1dbc9f
TLSH
T159F0C85571C4AE9713735E32C5224781FE71565B016520D874AE227B5F315CB07E32DA
MD5 SHA1 SHA512 TLSH

Submit Download

oglgujkx.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\oglgujkx.newcfg
Size 839B
SHA256 97cb52fa2e8cdf22303dee3d349d99153fd36b21e9537168ee44b5449ef08041
MD5 ad54b109d5d3f18ab1da239c28b86695
SHA1 ed914d2e2c6c565cade4cf2bc325699637ae42a6
SHA512 a21aee74b1128fba63f4bf770c876bf816f6a045c3d60ddf606538ad1f604dc0dd760df3d979229246b3e8ae1c8bdec782d6f5fbfe2add20959ed3c17d4b11ee
TLSH
T1C301685871C0AE8A02736A32D63143C0FE715757022A60D874EE22375F308DF07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\user.config
Size 520B
SHA256 f3e60c777d40ae6ca5751b2ccadb116918be4ca4357b722831c6d122b3a02fa3
MD5 5ab654882e92a36eebf2b04e564d18a5
SHA1 7548c0f6929a2938f27405f2001d5178db393102
SHA512 322be3ba47e36cfb90b790374625408d444d89e58e98473308e40f4a0fd376f3626c5e25edfef408f20bfedfa95426190602d96d15d49a71bc5f724fd12182ff
TLSH
T1D8F0E9A131C46D4703A35E23C5224741FE72679B0555209874AF227B5F315CE03E31CE
MD5 SHA1 SHA512 TLSH

Submit Download

y0lfqz1x.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f80a49e1ea431227)\y0lfqz1x.newcfg
Size 839B
SHA256 7b852c564d8604e9ee59acddb94bc7cb0d8fd208550f0270ee361672bf2f1b77
MD5 79105b34d7f1ada27596dddc476d626f
SHA1 505805a60c8b2d211d01434f0942675cd2c0180c
SHA512 8de16dda86e6d775d0d644ea388de3e14d2d5ac0ec4a98be0af73e48778e392a8e3cf277088b4aa86dc098326bd59721b94a12d2c591ccec91702430185ee663
TLSH
T17401685871C0AE8A02B36E32D63143C4FE715B57022A60D874EE22375F308DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

{2a96167a-c58d-4ddb-a3b2-babe9ed8970b}_OnDiskSnapshotProp

Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{2a96167a-c58d-4ddb-a3b2-babe9ed8970b}_OnDiskSnapshotProp
Size 6KB
SHA256 a14c80b56a30a6efa7829224e298d6b6b44cf3c2d4719f575ec20925fb98fce6
MD5 bc47c8192454148fdb984ba5e483b3c6
SHA1 c5e985f3f824d2086672779365132c86c238a179
SHA512 1e393b224e64e073e735b8f25bed55c589e64a16da2492ad1a187f899c2396592c55361677be57d9efd8dc31044b954415b14fb7cc6660b5df057af67aa1f19d
SSDEEP 96:FjcFKvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:dvb++uVm
TLSH
T120D187184AF54711E2B3AB7128F58557A837B812EF33CB8E0198238E2621910F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-38-0x00000000058C0000-0x00000000058CC000-memory.dmp

Download

memory/1128-34-0x0000000005880000-0x00000000058AE000-memory.dmp

Download

memory/1128-42-0x0000000005AD0000-0x0000000005C20000-memory.dmp

Download

memory/1128-46-0x0000000005E10000-0x0000000005FF4000-memory.dmp

Download

memory/3100-5-0x0000000074D90000-0x000000007554C000-memory.dmp

Download

memory/3100-8-0x00000000072E0000-0x00000000074C4000-memory.dmp

Download

memory/3100-10-0x0000000074D90000-0x000000007554C000-memory.dmp

Download

memory/3100-7-0x0000000074D90000-0x000000007554C000-memory.dmp

Download

memory/3100-6-0x0000000006EB0000-0x0000000006F1E000-memory.dmp

Download

memory/3100-4-0x0000000006B20000-0x0000000006C70000-memory.dmp

Download

memory/3100-3-0x0000000074D90000-0x000000007554C000-memory.dmp

Download

memory/3100-9-0x0000000007A80000-0x000000000803A000-memory.dmp

Download

memory/3100-2-0x0000000002B00000-0x0000000002B10000-memory.dmp

Download

memory/3100-1-0x0000000002AD0000-0x0000000002AD8000-memory.dmp

Download

memory/3100-11-0x0000000007830000-0x00000000078C2000-memory.dmp

Download

memory/3100-13-0x0000000074D90000-0x000000007554C000-memory.dmp

Download

memory/3100-0-0x0000000074DA2000-0x0000000074DA3000-memory.dmp

Download

memory/3352-76-0x0000000005960000-0x00000000059CE000-memory.dmp

Download

memory/4360-154-0x0000000003880000-0x00000000038B4000-memory.dmp

Download

memory/4360-197-0x0000000004750000-0x00000000047F2000-memory.dmp

Download

memory/4360-178-0x0000000004650000-0x00000000046A0000-memory.dmp

Download

memory/4360-168-0x0000000004180000-0x0000000004364000-memory.dmp

Download

memory/4360-160-0x0000000003B40000-0x0000000003C90000-memory.dmp

Download

memory/4560-224-0x000000001C860000-0x000000001C9E8000-memory.dmp

Download

memory/4560-223-0x0000000002850000-0x0000000002884000-memory.dmp

Download

memory/4560-222-0x000000001BDE0000-0x000000001BFC4000-memory.dmp

Download

memory/4560-221-0x000000001BAA0000-0x000000001BBF0000-memory.dmp

Download

memory/4560-220-0x000000001B390000-0x000000001B432000-memory.dmp

Download

memory/4560-219-0x00000000005D0000-0x0000000000760000-memory.dmp

Download